[Bug 2497651] New: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
Bug ID: 2497651 Summary: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation [fedora-all] Product: Fedora Version: rawhide Status: NEW Whiteboard: {"flaws": ["58986166-cf06-41ca-a3ec-716c8928d097"]} Component: sssd Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: sssd-maintainers@lists.fedoraproject.org Reporter: snegrini@redhat.com QA Contact: extras-qa@fedoraproject.org CC: abokovoy@redhat.com, atikhono@redhat.com, lslebodn@redhat.com, pbrezina@redhat.com, sbose@redhat.com, ssorce@redhat.com, sssd-maintainers@lists.fedoraproject.org Blocks: 2496556 (CVE-2026-14474) Target Milestone: --- Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
When ldap_sudo_search_base is not explicitly configured (the default), SSSD falls back to the domain's root DN and searches the entire LDAP directory tree for objects matching (objectClass=sudoRole) with SUBTREE scope. Any LDAP principal with write access to any subtree can create a sudoRole object granting arbitrary sudo privileges on every SSSD-enrolled host.
This affects sudo_provider = ldap and sudo_provider = ad (which delegates to sdap_sudo_init()). sudo_provider = ipa is NOT affected.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2496556 [Bug 2496556] CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
Alexey Tikhonov atikhono@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|sssd-maintainers@lists.fedo |atikhono@redhat.com |raproject.org | Status|NEW |ASSIGNED
--- Comment #1 from Alexey Tikhonov atikhono@redhat.com --- Upstream PR: https://github.com/SSSD/sssd/pull/8897
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
--- Comment #2 from Alexey Tikhonov atikhono@redhat.com --- Fixed upstream by https://github.com/SSSD/sssd/commit/ff8c1b19bcdbf79b733b052a7d926bd920b1205d
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|POST |MODIFIED
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-5acfb0243b (CVE-2026-12610 CVE-2026-14474 CVE-2026-14476) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-5acfb0243b
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
--- Comment #4 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-9ab663dcd4 (CVE-2026-12610 CVE-2026-14474 CVE-2026-14476) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-9ab663dcd4
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |ON_QA
--- Comment #5 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-5acfb0243b has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-5acfb0243b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-5acfb0243b
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
--- Comment #6 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-9ab663dcd4 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9ab663dcd4` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-9ab663dcd4
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |MODIFIED
--- Comment #7 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-8fad0036a5 (sssd-2.13.1-3.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-8fad0036a5
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |ERRATA Fixed In Version| |sssd-2.13.1-3.fc45 Last Closed| |2026-07-10 13:06:44
--- Comment #8 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-8fad0036a5 (sssd-2.13.1-3.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
--- Comment #9 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-5acfb0243b (CVE-2026-12610 CVE-2026-14474 CVE-2026-14476) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=2497651
--- Comment #10 from Fedora Update System updates@fedoraproject.org --- FEDORA-2026-9ab663dcd4 (CVE-2026-12610 CVE-2026-14474 CVE-2026-14476) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
sssd-maintainers@lists.fedoraproject.org
-
bugzilla＠redhat.com